GitHub Advisory Database8 days ago

pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. [pypi-publish]: https://git

Published October 30, 2026 · 8:24 PM
Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. [pypi-publish]: https://git
Read

Source: GitHub Advisory Database

Ask AI about this articleBeta

The AI only has access to this article — it won't make up facts. Try:

AI can be wrong. Cross-check before sharing.

Supporting evidence0 items
Community check0 comments
No votes yet
0% real0% fake